The client credentials grant type lets one service authenticate directly with an identity provider (IdP), obtain an access token, and call another service without user involvement. It fits service-to-service communication, such as an order service calling a billing or payment service. section 12.2.3 section 16.2.1
A typical flow works like this:
- The calling service authenticates to the IdP with its client ID and client secret. section 12.2.3
- The IdP issues an access token, usually a JWT with a limited lifespan. section 16.2.1
- The calling service attaches the token to requests sent to the resource server. section 12.2.3
- The receiving service validates the token, checks the caller’s authorization, and processes or rejects the request. section 16.2
Spring Security configuration
A service can configure the grant type with an OAuth2 client registration, client credentials, scopes, and the authorization server’s token endpoint: authorization-grant-type: client_credentials; scope: read,write; token-uri: https://auth-server.com/oauth2/token. Framework configuration reduces implementation effort while leaving room for customization. section 16.2.1
This flow is preferable to a shared static API key when services need managed authentication. API keys are easier to use but are difficult to rotate, easy to spoof after leakage, and provide little useful identity information. section 16.2 section 16.4
Figure 16.5 The client credentials flow. Each service obtains a token from an IdP by providing its valid client credentials. The service uses this token to send requests to other services in the system. The token has a limited lifespan, and a service must get a new token from time to time.
Trace token acquisition, limited token lifetime, and service-to-service requests in the client credentials flow. section 16.2.1
